diff --git a/.github/deployment/cloud-dev.hcl b/.github/deployment/cloud-dev.hcl
index 6dfbaa2d7..d5e4d8822 100644
--- a/.github/deployment/cloud-dev.hcl
+++ b/.github/deployment/cloud-dev.hcl
@@ -68,6 +68,7 @@ SIGN_KEY            = "{{ key "service/development/affine-cloud/sign_key" }}"
 MAIL_ACCOUNT        = "{{ key "service/development/affine-cloud/mail_account" }}"
 MAIL_PASSWORD       = "{{ key "service/development/affine-cloud/mail_password" }}"
 JWST_DEV            = "1"
+AFFINE_CLOUD_LOG    = "debug,mio=off,hyper=off,rustls=off,tantivy=off,sqlx::query=off,jwst_rpc=trace,jwst_rpc::context=info,affine_cloud=trace"
 EOH
 
         destination = "secrets/.env"
@@ -75,7 +76,7 @@ EOH
       }
 
       config {
-        image      = "ghcr.io/toeverything/cloud:${DOCKER_TAG}"
+        image      = "ghcr.io/toeverything/cloud-self-hosted:${DOCKER_TAG}"
         force_pull = true
         ports      = ["affine-cloud"]
       }
diff --git a/.github/deployment/cloud-stage.hcl b/.github/deployment/cloud-stage.hcl
index 08deca1ca..bab09ef26 100644
--- a/.github/deployment/cloud-stage.hcl
+++ b/.github/deployment/cloud-stage.hcl
@@ -38,7 +38,7 @@ job "affine-cloud-stage" {
     }
 
     service {
-      tags = ["urlprefix-stage.affine.live/", "urlprefix-stage.affine.pro/"]
+      tags = ["urlprefix-api-stage.affine.live/"]
       port = "affine-cloud"
       check {
         name     = "Affine Cloud Stage Check"
@@ -61,11 +61,14 @@ job "affine-cloud-stage" {
       }
       template {
         data = <<EOH
-DOCKER_TAG          = "{{ key "service/stage/affine-cloud/tag" }}"
-DATABASE_URL        = "postgresql://affine:{{ key "service/stage/affine-cloud/database_password" }}@{{ env "NOMAD_ADDR_postgres" }}/affine"
-SIGN_KEY            = "{{ key "service/stage/affine-cloud/sign_key" }}"
-MAIL_ACCOUNT        = "{{ key "service/stage/affine-cloud/mail_account" }}"
-MAIL_PASSWORD       = "{{ key "service/stage/affine-cloud/mail_password" }}"
+DOCKER_TAG                    = "{{ key "service/stage/affine-cloud/tag" }}"
+DATABASE_URL                  = "postgresql://affine:{{ key "service/stage/affine-cloud/database_password" }}@{{ env "NOMAD_ADDR_postgres" }}/affine"
+SIGN_KEY                      = "{{ key "service/stage/affine-cloud/sign_key" }}"
+MAIL_ACCOUNT                  = "{{ key "service/stage/affine-cloud/mail_account" }}"
+MAIL_PASSWORD                 = "{{ key "service/stage/affine-cloud/mail_password" }}"
+AFFINE_CLOUD_LOG              = "debug,mio=info,hyper=info,rustls=info,tantivy=off,sqlx::query=off,jwst_rpc=trace,jwst_rpc::context=info,affine_cloud=trace"
+JWT_ACCESS_TOKEN_EXPIRES_IN   = "3600"
+JWT_REFRESH_TOKEN_EXPIRES_IN  = "2592000"
 EOH
 
         destination = "secrets/.env"
@@ -73,7 +76,7 @@ EOH
       }
 
       config {
-        image      = "ghcr.io/toeverything/cloud:${DOCKER_TAG}"
+        image      = "ghcr.io/toeverything/cloud-self-hosted:${DOCKER_TAG}"
         force_pull = true
         ports      = ["affine-cloud"]
       }
diff --git a/apps/cloud/src/api/mod.rs b/apps/cloud/src/api/mod.rs
index baa3b3af9..2e17eb447 100644
--- a/apps/cloud/src/api/mod.rs
+++ b/apps/cloud/src/api/mod.rs
@@ -195,19 +195,24 @@ pub async fn make_token(
             }
         }
         MakeToken::Google { token } => {
-            if let Ok(claims) = ctx
+            match ctx
                 .firebase
                 .lock()
                 .await
                 .decode_google_token(token, ctx.config.refresh_token_expires_in)
                 .await
             {
-                match ctx.db.firebase_user_login(&claims).await {
+                Ok(claims) => match ctx.db.firebase_user_login(&claims).await {
                     Ok(user) => (Ok(Some(user)), None),
-                    Err(_) => return ErrorStatus::InternalServerError.into_response(),
+                    Err(e) => {
+                        error!("failed to auth: {:?}", e,);
+                        return ErrorStatus::InternalServerError.into_response();
+                    }
+                },
+                Err(e) => {
+                    error!("failed to check token: {:?}", e);
+                    return ErrorStatus::Unauthorized.into_response();
                 }
-            } else {
-                (Ok(None), None)
             }
         }
         MakeToken::Refresh { token } => {